On 24 September 2026, Google released its September 2026 spam update, the fourth spam update the company has issued this year. The rollout is running globally, across every language Google indexes, and Google has said it may take up to two weeks to complete. That timeline alone is worth pausing on, because none of the three spam updates that came before it in 2026 took anywhere near that long.
Most of what gets published about a spam update on the day it lands simply repeats the announcement: the date, the fact that it is global, and a reminder to check your rankings. That is useful as far as it goes, but it is not much use to a business owner trying to work out whether they actually need to do anything. This post covers what changed, what a spam update is looking for, and the specific checks worth running before assuming anything is wrong.
What Google actually announced
Google confirmed the update through its Search Status Dashboard, the same channel it uses for every ranking-related change. The note was short: the September 2026 spam update has been released, it applies globally and to all languages, and the rollout may take up to two weeks. No new spam policy was introduced alongside it, and Google did not name a specific tactic this update is aimed at, which has been the pattern for every spam update this year.
This is the fourth time in 2026 that Google has issued this type of update, following releases in March, June and August. Four in nine months is a faster cadence than Google kept in previous years, when a single spam update every few months, or even just once a year, was closer to the norm.
A spam update is not a core update
The two terms get used interchangeably by people who have not worked with either, so it is worth being precise, because it changes what a business should actually do in response.
A core update reassesses how Google evaluates content quality and relevance across the entire web. It can move rankings for almost any site, in any sector, whether or not that site has done anything wrong. A spam update is narrower. It acts only on sites that breach one of Google’s named spam policies, using SpamBrain, Google’s automated spam-detection system, rather than a human review. There is no message that lands in Search Console, no explanation, and nothing to appeal. If a site’s visibility drops because of a genuine spam policy breach, recovery depends on fixing the underlying issue and waiting for Google’s systems to reassess the site, a process the company itself says can take months rather than weeks.
The practical upshot: if your site has not been using any of the tactics below, a spam update is very unlikely to be the reason behind a ranking change you are seeing this week.
Why the rollout length matters more than the update itself
This is the part most coverage of the September update has skipped, and it is the genuinely useful bit. Look at how long each of this year’s four spam updates actually took to roll out:
- March 2026: Finished in under 24 hours, the fastest spam update rollout Google has recorded.
- June 2026: Took around two days, from 24 to 26 June.
- August 2026: Google said this would take “a few days”.
- September 2026: Google is saying up to two weeks, by far the longest window given for a spam update this year.
A longer rollout window generally means Google’s systems are working through a larger or more complex set of signals before settling on a final position for affected sites. It also means judging the update’s impact from the first few days of movement is unreliable. Anyone reading a small dip or rise in the first 48 hours of a two-week rollout is looking at a partial result, not the outcome.
What Google’s spam policies actually cover
Google groups search spam into a set of named policies, and the same handful reappear in almost every spam update. In plain terms, these are the practices being targeted:
- Scaled content abuse: Publishing a large number of pages, often produced with AI or minimal human input, where the primary purpose is to capture rankings rather than genuinely help the reader. Publishing regularly is not the issue; publishing volume with no real value behind it is.
- Site reputation abuse: Sometimes called parasite SEO, this is when a third party places weak content on someone else’s established, trusted domain purely to borrow its ranking power.
- Expired domain abuse: Buying a domain that used to belong to someone else and repurposing it for unrelated, low-value content to trade on its existing authority.
- Link spam: Buying links, exchanging them in bulk, or using automated tools to build links purely to manipulate rankings, rather than earning them editorially.
- Cloaking and sneaky redirects: Showing Google’s crawlers something different to what a visitor actually sees on the page.
Original content written for a real audience, and links earned because other sites genuinely wanted to reference you, sit well outside any of this. If that describes your website, a spam update is not something to lose sleep over.
How to check whether this update has touched your site
Rather than guessing, run these checks against the actual rollout window, 24 September to roughly 8 October 2026:
- Open the Performance report in Google Search Console and compare organic clicks and impressions either side of 24 September. A change that tracks the rollout dates points to this update; a change that started earlier or later almost certainly has a different cause.
- Check the Manual Actions report in Search Console. A manual action means a human reviewer flagged your site directly, which is a separate process from an algorithmic spam update and needs its own fix and reconsideration request.
- Rule out the obvious alternatives first: a recent site migration, a Core Web Vitals issue, seasonal demand, or a competitor simply publishing something better than what currently ranks above them. All of these get mistaken for algorithm updates far more often than people expect.
- Give it the full two weeks before drawing conclusions. Reacting to day-three data on a fourteen-day rollout wastes effort on a problem that may resolve, or may not yet have fully appeared.
What to do if you are not affected
For most legitimate UK businesses, this update will change nothing. That is genuinely the expected outcome, not a lucky escape. If a site is not using any of the tactics above, there is nothing to fix in response to a spam update, because the update was never aimed at it.
What is worth doing instead is treating September’s update as a prompt to check that your on-going SEO strategy still holds up against current policy, rather than something built around shortcuts a few years ago that Google has since closed off. It is also worth reviewing your Search Console reporting on a proper schedule rather than only opening it when something feels wrong, since the businesses that spot a genuine drop early are always the ones already in the habit of checking. Four spam updates in nine months, with rollout windows now stretching to two weeks, is a fair signal that Google is tightening enforcement rather than easing off. Sites built on genuine content and earned authority have nothing to fear from that trend. Sites relying on shortcuts have steadily less room to operate in. If you are not sure which category your website falls into, that is exactly the kind of thing worth a proper audit before the next update lands, not after.
Graig Upton
Graig Upton is a UK SEO and Google Ads consultant with 23 years of hands-on digital marketing experience. Google certified in Ads, Analytics and Conversions, he has helped businesses ranging from local providers to national brands - including Nando's and Financial Times - dominate search and scale their leads. Based in Preston, working with clients across the UK.